When the board starts knocking, well-meaning CISOs and security teams spring into action, ordering up assessments and other services from a growing cottage industry of third-party security consultants. That's healthy too — healthcare is one of many industries that needs an ecosystem of support around security activities.

The best assessments are sound, complete, and actionable. The worst ones ain't.

Given a statement of work from a third-party assessor, how can you tell whether it's sound, complete, and actionable? That's for a forthcoming post. This post is about one kind of unhelpful assessment: the kind that's only a penetration test.

Clinicians now have a peer-reviewed guide from a medical journal on how to evaluate when a medical device security problem translates into a clinical risk.

There's been a lot of confusion on risk management for pacemaker and defibrillator security because of the difficulty in explaining medical device security in the context of patient safety and risk management. We are pleased to announce our latest publication on the science and engineering to assess risks of medical device security. Led by Virta Labs, the peer-reviewed paper published in Pacing and Clinical Electrophysiology (PACE) is co-authored by researchers (including four PhDs and two MDs) with backgrounds in electrical engineering, computer science, IT security, and electrophysiology from Virta Laboratories, Beth Israel Deaconess Medical Center, the Mayo Clinic, Zhejiang University, the University of South Carolina, and the University of Michigan Health System.

SECURITY IS CONTINUITY OF OPERATIONS

Virta Labs builds security tools tailored to healthcare. With a decade of experience in healthcare security, we understand the importance of respecting safety and clinical workflow. We help healthcare IT focus on the risks that matter.